Microsoft released out-of-band .NET updates for a Brotli decoder memory-corruption vulnerability and a tarball installation ownership issue. Fixed versions are 8.0.33, 9.0.22, 10.0.14 and 11 RC3. Applications that process untrusted Brotli data should review exposure; automatic request and response decompression is disabled by default. .NET Framework is unaffected. Updating only the host runtime is insufficient for self-contained applications and containers, which need to be rebuilt and redeployed with fixed versions.